ServiceNow Developer Interview Master Guide (2026 Edition)

Comprehensive, scenariobased, productiongrade answers for 90+ real interview questions across scripting, integrations,

CMDB, workflows, performance, architecture, and L3 troubleshooting.

1. SCRIPTING & PLATFORM LOGIC

- Business Rule updating record twice fix: Check duplicate BRs, recursion, [Link](), Flow triggers. Use Debug

Business Rule. Add recursion guard or remove unnecessary updates.

- Client Script vs BR mismatch: Client Script updates UI only; BR updates DB. Move logic to server or use GlideAjax.

- Script Include not accessible: Not Client Callable, wrong scope, wrong class name. Use GlideAjax format.

- Prevent recursive BR execution: Use flags or setWorkflow(false).

- Optimize slow GlideRecord: Add indexes, use encoded queries, limit results, avoid loops.

- Fetch 10k records safely: Use pagination, Background Scripts, GlideAggregate.

- Before BR not updating: Wrong order, read-only field, condition mismatch.

- [Link]() vs setWorkflow(false): update() triggers workflows; setWorkflow(false) prevents them.

- Why GlideAggregate: Efficient for COUNT, SUM, GROUP BY.

- Script Include fails in scoped app: Not accessible from other scopes; fix Application Access.

2. ACL & SECURITY

- User has role but no access: Debug Security Rules; check table + field ACLs; domain issues.

- Multiple ACL evaluation: All matching ACLs must return true.

- Field visible but not editable: Write ACL, UI Policy, Client Script, dictionary read-only.

- ACL script true but access denied: Another ACL returned false.

- Dynamic row-level security: Use ACL script with GlideRecord checks.

- Table vs field ACL conflict: Table ACL must allow first; field ACL can further restrict.

- Why * ACL is dangerous: Grants access to all tables.

- Debug ACL: Use Debug Security Rules + impersonation.

- API access but not UI: API uses different ACL path; Scripted APIs may bypass ACL.

- ACL performance impact: Heavy scripts slow list loads; avoid GR loops.

3. INTEGRATIONS

- REST API intermittent failure: Check logs, token expiry, payload size, rate limits. Implement retry logic.

- MID Server up but integration failing: ECC stuck, wrong capabilities, firewall issues.

- Secure outbound REST: OAuth2, mTLS, Credential Store, MID Server.

- SOAP vs REST: SOAP for strict schema; REST for lightweight JSON.

- Slow API response: Use async mode, reduce payload, caching.

- OAuth token auto-refresh: Store refresh token; regenerate before expiry.

- Integration logging: Use custom log table + syslog.

- Retry mechanism: Retry only for 408/429/500/502/503.

- Transform Map vs Scripted REST API: Transform Map for batch loads; Scripted REST for real-time.

4. FLOW DESIGNER & WORKFLOW

- Flow triggered twice: Duplicate flows, broad triggers, BR calling flow.

- Workflow Editor vs Flow Designer: Workflow for complex parallel logic; Flow for modern automation.

- Flow stuck in Waiting: Pending approvals, scheduled actions, missing events.

- Subflow vs Action: Subflow = reusable logic; Action = reusable scripted step.

- Rollback handling: Use compensation logic + error handler.

- Flow performance issues: Use batching, async processing, Script Actions.

- Error handling: Use Error Handler path + logging.

- Large dataset failures: Memory/time limits; use pagination.

- Event vs record-triggered: Event for async + recursion prevention.

- Workflow migration challenges: No direct migration; rewrite timers, approvals, scripts.

5. CMDB, DISCOVERY & SERVICE MAPPING

- Duplicate CIs: Fix IRE rules, coalesce fields, merge duplicates.

- Wrong CI class: Fix classification patterns, probes, sensors.

- How IRE works: Identification = match CI; Reconciliation = attribute ownership.

- Service Mapping missing dependencies: Fix entry point, firewall, credentials, pattern steps.

- CMDB performance: Indexes, archiving, optimized queries.

- CI relationship impact: Better incident impact + change risk.

- Stale CI handling: Use Last Discovered; auto-retire.

- Discovery schedule not triggering: MID down, ECC stuck, schedule disabled.

- Clean CMDB design: Standard classes, naming, ownership, normalization.

- Manual vs automated CI creation: Manual = inconsistent; automated = accurate.

6. SERVICE CATALOG & PORTAL

- MRVS not available in workflow: Use GlideappMultiRowQuestionAnswer.

- Widget not loading: Angular errors, missing dependencies, script errors.

- Catalog Client Script vs normal: Catalog runs in portal; limited DOM access.

- Passing data server -> client: Use $[Link].

- Portal performance: Reduce widgets, cache data, avoid heavy GR loops.

- Employee Center vs Portal: EC for unified UX; Portal for custom UI.

- UI Policy not working: Not applied to catalog; conflicting scripts.

- Dynamic catalog forms: Use g_user.hasRole() or User Criteria.

- Works in UI but fails in portal: DOM APIs not supported; fix scripts.

7. PERFORMANCE & OPTIMIZATION

- Instance slow after upgrade: Check skipped updates, deprecated APIs, slow queries.

- Slow form load: Too many scripts, related lists, synchronous calls.

- Background script issues: Check execution tracker; batch processing.

- Importance of indexes: Faster queries, reduced table scans.

- Optimize GlideRecord: Use encoded queries, limits, avoid loops.

- Large table cleanup: Archiving, indexing, partitioning.

- Long-running transactions: Use async BRs, events, batching.

- Script execution order: BR -> Display -> Client Script -> UI Policy.

- Memory leaks: Avoid storing GR objects in arrays.

- PA vs Reports: PA = trends; Reports = real-time.

8. REAL-TIME L3 PRODUCTION ISSUES

- Incident not created via integration: Check logs, token, payload, ECC.

- SLA not triggering: Conditions, schedules, retroactive start.

- Notifications not sent: Email disabled, event not fired, user email blank.

- Data mismatch across environments: Missing update sets, skipped records.

- Catalog item not submitting: Hidden mandatory variable, script errors.

- Script works in dev but not prod: Missing roles, ACLs, Script Include access.

- Unexpected data deletion: BR delete logic, REST API delete, fix scripts.

- Broken workflows post-upgrade: Deprecated activities, script errors.

- Emergency fix deployment: Emergency update set + quick testing.

9. ARCHITECTURE & DESIGN THINKING

- Scalable design for 1M+ records: Batch processing, async logic, indexing.

- Avoid over-customization: Prefer configuration, extension points.

- Script Include vs BR: Script Include = reusable logic; BR = DB triggers.

- Reusable components: Subflows, Actions, Script Includes.

- Multi-instance architecture: Regional MID Servers, scoped apps, pipelines.

- Governance model: CAB, code reviews, naming standards.

- Scoped vs global: Scoped = isolation; Global = shared utilities.

- Secure integration architecture: OAuth2, mTLS, encryption.

- Upgrade-safe design: No OOB modification; use extension points.

- Enterprise best practices: Modular, reusable, secure, documented.

10. BONUS ULTRA-TOUGH QUESTIONS

- Isolating performance degradation: Layered isolation: integrations -> flows -> BRs -> DB.

- Redesigning multi-trigger processes: Replace BRs with event + subflows.

- Real-time sync without performance hit: Webhooks + async outbound + queue table.

- Standardizing CMDB across regions: Global class model, IRE rules, normalization.

- Portal slowness first 30 minutes: Check console, slow widgets, server logs.

- Full implementation review checklist: CMDB, ACLs, integrations, flows, scripts, governance.

- CI/CD strategy: Git, pipelines, ATF, scoped apps.

- Security compliance: ACLs, encryption, audit logs, mTLS.

- Fail-safe integrations: Retry logic, dead-letter queue, idempotency.

- Redesigning ITSM: Flow Designer, CMDB-driven routing, modular apps.